The document discusses API security features provided by Barracuda Web Application Firewall. It outlines seven security features including DDoS prevention, bot mitigation, IP reputation, rate controlling, SSL/TLS security, access control, and cloaking. It also describes the scope of protection such as DDoS exploits, abuse, protocols, and supported API types like XML, SOAP, and RESTful APIs using JSON. Layer 7 security coverage is provided for requests and responses between the API client and server.

1. Barracuda Web Application
Firewall
API Security

2. Agenda
API Security Overview
Security Features- In Depth Analysis

3. API Security Features
WAF as
API Proxy
1. DDOS Prevention
2. Bot Mitigation, IP Reputation, Rate Controlling
3. SSL/TLS Security
4. API Message Security
Inbound Inspection Outbound Inspection
API Server
7. Cloaking
5. Protocol Security
6. Access Control

4. Scope of Protection
DDOS Exploits
AbuseAccess
• In-Built DDoS
prevention
• Cloud Service
based DDoS
prevention
• OAUTH*
(Upcoming)
• SAMLv2
• JSON Profiling
• JSON key profiling
• XML/SOAP
Validation
• WSDL Schema
Validation
• Bot Mitigation
• IP Reputation check
• Rate Controlling
• Web Scraping
protection

5. Supported APITypes
• XMLWeb Services
• SOAP [Simple Object Access Protocol] based
• RESTfulWeb Services
• JSON [JavaScript Object Notation] based

6. Layer-7 Security Coverage
Response
API
Server/
Endpoint
Tommy
Request

7. Message Security: JSON Payload
Inspection
JSON Profile
Key Profile
JSON Policy
Client
JSON Security
Content-Type: application/json
API REQUEST
Action Policy
RuleViolation
RESPONSE